Linux kernel tegra241-cmdqv: use-after-free issuing CMD_SYNC on a freed command queue at teardown

Impact

arm_smmu_impl_remove() is registered as a devres action before arm_smmu_init_queues() allocates smmu->cmdq.q.base, so on any devres unwind the command queue is freed first and the impl remove path then runs tegra241_cmdqv_remove_vintf(), whose VINTF deinit issues a CMD_SYNC against that freed memory. The reported trace is a kernel paging fault in arm_smmu_cmdq_issue_cmdlist() reached through devres_release_all(). Two paths get there: a failed SMMU probe (observed when the VCMDQ fails to enable, so the impl reset fails and probe aborts) and a live driver unbind. tegra241_cmdqv_remove_vintf() is also on the iommufd viommu destroy path, so it is reachable from normal passthrough teardown rather than only from driver surgery. This is the SMMU on NVIDIA Grace silicon - the IOMMU sitting between assigned GPUs and NICs and host memory on GH200/GB200-class nodes, where a boot-time probe failure now means a crashed node instead of a degraded one.

Who can reach it

Local, and mostly not attacker-driven: a failing SMMU probe at boot, a driver unbind, or an iommufd viommu destroy on a Grace-based host. Reaching the viommu destroy path requires holding an iommufd descriptor for a passthrough device.

What to do

Apply the stable kernel fix on Grace-based nodes; it drops the VINTF deinit from the remove path and quiesces the VINTFs earlier via a new device_disable() impl op run from arm_smmu_disable_action() while the CMDQ is still up, plus a quiesce on the iommufd viommu destroy path. Kernel change on the boot path, so each affected node needs a drain and reboot onto the patched kernel; livepatch is not a realistic option for a probe-time fix. Non-Grace hardware does not build or run this driver and needs no action.

References

Related entries

• Linux kernel virtio-crypto: unbounded device-reported result length over-reads guest kernel heapCVE-2026-80836 · Linux kernel virtio-crypto akcipher completion path (virtio_crypto_dataq_akcipher_callback)Unscored
• Linux KVM SEV: sub-page command buffer on SNP hosts triggers RMP faults and host panicCVE-2026-80853 · Linux KVM SEV (temporary buffer for {DE,EN}CRYPT ops on SNP-enabled hosts)Unscored
• Linux kernel FUSE: abort_on_kill returns without waiting for FR_FINISHED, freeing an in-flight requestCVE-2026-80857 · Linux kernel FUSE request handling (request_wait_answer abort_on_kill path)Unscored
• Linux kernel nvme-tcp: unserialized page_frag_cache corrupts page refcounts and panics the hostCVE-2026-80862 · Linux kernel nvme-tcp (page_frag_cache used unserialized for per-request PDU preallocation)Unscored
• Linux kernel bpf: copy_user_syms calls __get_user on a userspace pointer array with no access_ok checkCVE-2026-80865 · Linux kernel BPF kprobe_multi attach (copy_user_syms)Unscored
• Linux kernel vmwgfx: integer overflow in the shader offset bound check lets an unbounded offset reach host SVGA commandsCVE-2026-80887 · Linux kernel vmwgfx (vmw_shader_define shader size+offset bound check)Unscored